CCNA Ccsp Platform Security Questions — Page 2 of 2

MCQmedium

A security architect is designing a VPC for a three-tier web application. Which of the following VPC subnet designs provides the most secure isolation for the database tier?

A.Database tier in a private subnet with security group allowing only the application tier

B.Database tier in a separate VPC with VPC peering

C.Database tier in a public subnet with security group allowing only the application tier

D.Database tier in the same subnet as the application tier

AnswerA

Correct; private subnet with no internet gateway and restricted security group provides strong isolation.

Why this answer

Placing the database tier in an isolated private subnet without direct internet access and with strict security group rules minimizes exposure.

Practice this question →

Multi-Selectmedium

A cloud security auditor is reviewing container runtime configurations. Which TWO practices help prevent a container from compromising the host operating system?

Select 2 answers

A.Using a read-only root filesystem

B.Disabling SELinux inside the container

C.Running containers in privileged mode

D.Dropping all Linux capabilities

E.Mapping the host's Docker socket into the container

AnswersA, D

A read-only filesystem prevents writing to critical system areas.

Why this answer

Running containers without the --privileged flag and with a read-only root filesystem reduces the risk of host compromise.

Practice this question →

Multi-Selectmedium

A cloud security architect is evaluating options for private connectivity to cloud services without traversing the internet. Which TWO services can be used to achieve this? (Select two.)

Select 2 answers

A.VPC peering

B.Security group

C.VPC endpoint

D.Internet gateway

E.NAT gateway

AnswersA, C

VPC peering connects VPCs privately within the same cloud provider.

Why this answer

VPC endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) and VPC peering provide private connectivity without internet. Internet gateway and NAT gateway use internet; security groups are firewalls.

Practice this question →

MCQmedium

A cloud security architect is designing a multi-tenant environment using Type 1 hypervisors. Which of the following is the primary security risk associated with this architecture?

A.Insecure VM migration between hosts

B.Insufficient logging of hypervisor events

C.Resource contention leading to denial of service

D.VM escape from guest to hypervisor

AnswerD

VM escape is a major threat in multi-tenant environments as it could allow an attacker to control the hypervisor and access other tenants' VMs.

Why this answer

In multi-tenant cloud environments, VM escape is a critical risk where an attacker compromises a VM and attempts to break out to the hypervisor to access other VMs. Regular patching of the hypervisor mitigates this.

Practice this question →

MCQmedium

A cloud security analyst is reviewing the network architecture of a VPC. The security team wants to block all traffic from a known malicious IP address at the subnet level. Which AWS network security component should they use?

A.Network ACL (NACL)

B.Transit gateway

C.Security group

D.VPC peering connection

AnswerA

NACLs are stateless and allow explicit deny rules at the subnet level.

Why this answer

NACLs (Network Access Control Lists) are stateless firewalls that operate at the subnet level and support both allow and deny rules. Security groups are stateful and only support allow rules at the instance level.

Practice this question →